At the heart of the decision: Launch of a new study in cognitive science that gives voice to crisis management of cyber origin!

A crisis of cyber origin is not only played out on the technical field. While the IT response is essential to contain the incident, the survival of the structure is decided elsewhere: around the crisis cell table.

It is there, in this high-tension closed door, that executives, legal directors, communication managers and technical experts must collaborate. They are faced with a paradoxical situation: they have to make strategic decisions with serious consequences (stopping production, public communication, paying or not paying a ransom), all within a limited time and on the basis of information that is often fragmented, technical and in large quantities.

How, in this context of radical uncertainty, does the individual process information? How can we ensure that factors do not bias the judgment? To answer these questions, Nathan Vital, a doctoral student at Alcyconie, is conducting a unique doctoral research project, at the crossroads of cognitive psychology and cyber.

1. Genèse d’une rencontre : du terrain au laboratoire

This thesis project was not built ex nihilo. It is the result of a meeting between two worlds that have everything to gain from collaborating: operational expertise and academic rigor.

It all started during the preparation of Nathan Vital’s Master 2 internship. Its research director, Aline Chevalier (Professor of Cognitive Psychology and Ergonomics at the CLLE laboratory), was put in touch with Stéphanie Ledoux (CEO of Alcyconia) through a common acquaintance. From the first exchanges, a clear desire emerged on the part of Alcyconia: to understand the decision-making of operators in situations through a scientific prism.

In the field, during the immersive crisis exercises organized by Alcyconia, the experts observed recurring phenomena: hasty decisions, fixations on technical details, or difficulties in communicating.

The intuition then emerged that psychological mechanisms were at work, which is why it is necessary to move from observation to scientific explanation. A real need to understand, through an experimental prism, what was really at stake in the minds of decision-makers.

The observation: a scientific gap to be filled

During this M2 internship, while familiarizing himself with the scientific literature, the doctoral student made a striking observation. There was an abundance of work on decision-making in crisis situations (humanitarian, nuclear, aeronautics, etc.). For example, we knew how cognitive biases affected emergency doctors or pilots.

But paradoxically, cyber crisis management remained a blind spot in research. The specificities of this field (an intangible threat, a strong technicality, extreme time pressure and systemic consequences) had not been studied from the perspective of cognition.

It is from this observation that a common conviction was born between the laboratory and the company: it was urgent to develop a scientific approach dedicated to crisis management of cyber origin.

2. La thèse CIFRE : un pont entre recherche et entreprise

To achieve this ambition, the CIFRE (Industrial Convention for Training through Research) scheme, proposed by the ANRT (National Agency for Research and Technology), was the obvious choice. This system allows the doctoral student to carry out his research part-time in a public laboratory (here the CLLE laboratory, CNRS/University of Toulouse Jean Jaurès) and part-time in a company, at Alcyconie. This project, which is now the winner of the France 2030 “Cyber Critical Innovations” call for projects, meets a dual need:

1. Scientist: Fill the data gap on the cognition of decision-making in a cyber environment.
2. Societal: Strengthen the resilience of French organisations (OIVs, companies, local authorities) by giving them the keys to understanding how to better defend themselves.

3. Le cœur du réacteur : raisonnement et conscience de la situation

The research project is based on a central question: in the face of the unknown and pressure, how do we sort out in terms of information processing?

In a more serene situation, we have time to analyze each piece of information. But a cyberattack reshuffles the cards: the flow of information becomes massive, contradictory, and time is running out. In this context, the scientific literature tells us that humans change their mode of “functioning”. To save time, our brain uses “cognitive shortcuts”.

Intuition versus analysis This is the heart of the matter: the permanent tension between intuition (fast, automatic) and analysis (slower, more energy-intensive). While intuition is essential to react quickly, it can sometimes play tricks and alter the perception of reality.

The goal is to understand how these mechanisms influence situational awareness (the ability to understand what is really happening at the moment). Do these intense situations help to focus attention on the right elements, or on the contrary, do they lock the decision-maker into a tunnel vision? It is precisely in order to measure these invisible phenomena, without preconceptions, that it is necessary to collect data from the field.

4. Participez à l’étude nationale en cours

The project is currently in a pivotal phase: the collection of data for a first study. Having laid the theoretical foundations, it is now a question of observing how these mechanisms are activated in professionals in situations.

This is why a call for participation for a large-scale online study has been launched.

We are interested in your profile! Whether you are a CIO, CISO, member of the Management, Lawyer, HR or Communicator, if you have already been involved in cyber crisis management (whether real or during an exercise), your experience is valuable.

What does the study consist of? It is a secure online questionnaire (on the Qualtrics platform), lasting 20 to 25 minutes. You will be immersed in realistic crisis management scenarios. There are no “right” or “wrong” answers: the goal is simply to capture how you apprehend information and make decisions in an uncertain context.

Why participate? Participating means helping scientific research to better understand the human behind the screen. It means helping to make our organizations more resilient in the face of the threat.

In return, a feedback webinar will be organized at the end of the study to share with participants the major trends observed (anonymized) and the key lessons for their own practices.

Thank you for contributing to the production of scientific knowledge that will benefit the cyber field!

Study carried out by:

Nathan VITAL – PhD student in cognitive psychology – in CIFRE at Alcyconie